The flaw in rpm allows attackers to inject commands by tampering with the path or filename of a tarball that rpmbuild processes during its -t* mode. If an attacker supplies a tarball whose name or path contains shell metacharacters, rpmbuild will execute those characters as part of the build process, granting the attacker arbitrary code execution with the privileges of the user running the build. This can result in information disclosure, tampering with build artifacts, or disruption of automated build pipelines.

Affected systems include Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10, the Red Hat Hardened Images project, and the Red Hat Hummingbird release 1. The vulnerability stems from the rpm package bundled with these distributions, which is relied upon for building packages in many build environments.

The CVSS score of 7.8 indicates a high severity level. The EPSS score of 1% suggests a low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploits in the wild. Nevertheless, the attacker can craft a specially named tarball and invoke rpmbuild -t* within an automated build or continuous integration workflow, thereby satisfying the conditions for successful exploitation and achieving arbitrary command execution.